KR20200093455A - Method and system for network protocol state inference through reverse engineering - Google Patents

Abstract

A method for inferring a network protocol state through reverse engineering and a system thereof are disclosed. According to an embodiment of the present invention, the method comprises the steps of: receiving a plurality of first messages and a plurality of second messages transmitted from a plurality of hosts through at least one protocol; obtaining syntax information, semantic information, and timing information for the at least one protocol based on the plurality of first messages; and determining a state of the at least one protocol using the syntax information, the semantic information, and the timing information, and the length of messages received so far of the plurality of second messages.

Description

METHOD AND SYSTEM FOR NETWORK PROTOCOL STATE INFERENCE THROUGH REVERSE ENGINEERING}

The embodiments below relate to a method and system for network protocol state inference through reverse engineering.

In the recent Internet environment, a lot of information exchange has been performed through various protocols. Hosts exchange messages to exchange information. Most hosts communicate through public protocols such as the published international standard protocol or Transmission Control Protocol (TCP). However, existing protocols began to show limitations as new fields such as the Internet of Things (IoT) and the cloud developed and gradually began to have a close relationship with life. For example, the reliability of the existing TCP protocol is guaranteed, but it is too heavy to be used in IoT devices, so a delay occurs.

As these problems occurred, new protocols were developed through various studies such as weight reduction or speed improvement. The development of a new protocol has improved a lot in terms of convenience, such as quality of service, but on the contrary, in the field of security, new problems have started to emerge.

In the aspect of security, if the structure or logic of the protocol is not disclosed or is limitedly disclosed, the information of the protocol cannot be known by the conventional method. This also means that there is no way to manage or control the protocol. In addition to these protocols, in the case of protocols developed or modified in-house, there are many cases in which functions such as encryption and congestion control are not supported, and this causes various problems and security problems in the network.

Embodiments can provide a technique for determining the state of a protocol by using syntax information, semantics information, and timing information for a protocol, and the length of a message received so far. have.

A method for determining a protocol status according to an embodiment includes receiving a first plurality of messages and a second plurality of messages transmitted through at least one protocol from a plurality of hosts, and the plurality of messages Obtaining syntax information, semantics information, and timing information for the at least one protocol based on the first messages of the; and the syntax information, the semantic information, and the timing information. And determining the status of the at least one protocol using the length of the message received to date of the second plurality of messages.

The acquiring may include clustering the first plurality of messages for each protocol used for transmission of each of the first plurality of messages, and clustering the first plurality of messages using the clustered first plurality of messages. And obtaining the syntax information, the semantic information, and the timing information for a protocol corresponding to the first plurality of messages.

The obtaining of the syntax information, the semantic information, and the timing information for a protocol corresponding to the clustered first plurality of messages may include: an entire field and the field for the clustered first plurality of messages. Generating the syntax information using a static field for the first clustered messages, and generating the timing information using the clustered first plurality of messages and the static fields And generating the semantic information based on the syntax information and the timing information.

The generating of the syntax information may include extracting the static field from the clustered first plurality of messages, extracting a keyword repeated in a certain length from the static field, and extracting the keyword. Calculating a length of data for the clustered first plurality of messages using a length and a length of the entire field, and using the length of the data, the length of the entire field and the length of the keyword And generating information.

The generating of the timing information may include generating the timing information based on an order of keywords of each of the clustered first plurality of messages corresponding to an order of receiving the clustered first plurality of messages. Can.

The generating of the semantic information may include selecting at least one first data message among the first plurality of messages using the syntax information, and using the first data message and the timing information And generating information.

The determining may include selecting at least one second data message from the second plurality of messages using the timing information and the semantic information, and a buffer having a length equal to the length of the entire field. ), and the state of the protocol corresponding to the at least one second data message according to whether the length of the buffer and the length of the received message of the at least one second data message are the same. And determining.

Determining the state of the at least one protocol according to whether the length of the buffer and the length of the received message of the at least one or more second data messages are the same include: the length of the buffer and the at least one or more Determining that the state of the protocol corresponding to the at least one second data message is completed when the length of the received message to the present is the same, and the length of the buffer and the at least one data And when the length of the received message so far is not the same, determining that the status of the protocol corresponding to the at least one second data message is being received.

The method may further include performing fuzz testing on the keyword to determine an error in the transmission process of the plurality of first messages.

An apparatus for determining a protocol state according to an embodiment includes a memory for storing instructions for determining a state of a protocol, and a processor for executing the instructions, and when the instructions are executed by the processor, the processor includes a plurality of The first plurality of messages and the second plurality of messages transmitted through at least one protocol (protocol) from the hosts (host) of the, and based on the plurality of first messages to the at least one protocol Syntax information, semantics information, and timing information for acquiring, and obtaining the syntax information, the semantic information, and the timing information, and the length of a message received to date of the second plurality of messages Use to determine the state of the at least one protocol.

The processor clusters the first plurality of messages for each protocol used for transmission of each of the first plurality of messages, and uses the grouped first plurality of messages to cluster the first plurality of messages. The syntax information, the semantic information, and the timing information for a protocol corresponding to messages may be obtained.

The processor generates the syntax information using the entire field for the clustered first plurality of messages and a static field for the clustered first plurality of messages, and the clustering is performed. The timing information may be generated using the first plurality of messages and the static field, and the semantic information may be generated based on the syntax information and the timing information.

The processor extracts the static field from the clustered first plurality of messages, extracts a keyword repeated in a constant length from the static field, and uses the length of the keyword and the length of the entire field By calculating the length of data for the clustered first plurality of messages, the syntax information may be generated using the length of the data, the length of the entire field, and the length of the keyword.

The processor may generate the timing information based on the order of keywords of each of the clustered first plurality of messages corresponding to the order of receiving the clustered first plurality of messages.

The processor may select at least one first data message from the first plurality of messages using the syntax information, and generate the semantic information using the first data message and the timing information.

The processor selects at least one second data message from the second plurality of messages using the timing information and the semantic information, and generates a buffer having a length equal to the length of the entire field. , The state of the protocol corresponding to the at least one second data message may be determined according to whether the length of the buffer and the length of the at least one second data message received so far are the same.

The processor, when the length of the buffer and the length of the received message to the present time of the at least one or more second data messages are the same, determines that the state of the protocol corresponding to the at least one or more second data messages is completed. , When the length of the buffer and the length of the at least one data message received so far are not the same, it may be determined that the state of a protocol corresponding to the at least one second data message is being received.

The processor may perform an fuzz testing on the keyword to determine an error in the transmission process of the plurality of first messages.

1 is a diagram illustrating a system for protocol state determination according to an embodiment.
2 is a diagram schematically showing an example in which the system is implemented.
3 is a diagram schematically showing another example in which the system is implemented.
FIG. 4 is a diagram illustrating an example of a kernel-bypass structure used by the state determination device illustrated in FIG. 2.
5 is a flowchart schematically showing the operation of the state determination device.
FIG. 6 is a diagram schematically showing a state determination device illustrated in FIG. 1.
7 to 9 are diagrams for explaining clustering performed by the state determination apparatus on a plurality of messages.
10 to 12 are diagrams for describing an operation of the state determining device to acquire syntax information and keywords.
13 is a diagram for explaining a process in which the state determination device generates timing information and semantic information.
14 is a diagram for description of fuzz testing performed by a state determination device.
15 shows an example of an algorithm used by the state determining device to determine the state of the protocol.
16 is a diagram schematically showing a system according to another embodiment with a focus on transmission and reception of messages and ACKs.
17 to 24 are diagrams for explaining the performance evaluation results of the state determination device.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, various changes may be made to the embodiments, and the scope of the patent application right is not limited or limited by these embodiments. It should be understood that all modifications, equivalents, or substitutes for the embodiments are included in the scope of rights.

The terms used in the examples are used for illustrative purposes only and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as “include” or “have” are intended to indicate that a feature, number, step, operation, component, part, or combination thereof described on the specification exists, and that one or more other features are present. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

Terms such as first or second may be used to describe various components, but the components should not be limited by terms. The terms are for the purpose of distinguishing one component from another component, for example, without departing from the scope of rights according to the concept of the embodiment, the first component may be referred to as the second component, and similarly The second component may also be referred to as the first component.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person skilled in the art to which the embodiment belongs. Terms, such as those defined in a commonly used dictionary, should be interpreted as having meanings consistent with meanings in the context of related technologies, and should not be interpreted as ideal or excessively formal meanings unless explicitly defined in the present application. Does not.

In addition, in the description with reference to the accompanying drawings, the same reference numerals are assigned to the same components regardless of reference numerals, and redundant descriptions thereof will be omitted. In describing the embodiments, when it is determined that detailed descriptions of related known technologies may unnecessarily obscure the subject matter of the embodiments, the detailed descriptions will be omitted.

1 is a diagram illustrating a system for determining a protocol state according to an embodiment, FIG. 2 is a diagram schematically showing an example in which the system is implemented, and FIG. 3 is a diagram schematically showing another example in which the system is implemented , FIG. 4 is a diagram illustrating an example of a kernel-bypass structure used by the state determination apparatus shown in FIG. 2, and FIG. 5 is a flowchart schematically showing the operation of the state determination apparatus.

The system 10 includes a plurality of hosts 100 and a status determining device 300.

The system 10 may infer protocol and reverse engineering of a transport layer protocol that does not know the structure or logic based on packet trace to infer information and status about the protocol.

Protocol reverse engineering may mean a process of analyzing a protocol to grasp the components of a current protocol and its dependencies, abstracting the protocol, and extracting and generating design information of the protocol. The system 10 can analyze the structure and state from the characteristics of each protocol through various automation methods such as clustering.

The system 10 may perform protocol reverse engineering through 1) analysis of the type, structure, and size of protocol messages, and 2) correlation analysis through a state machine.

The plurality of hosts 100 may perform communication through the network 1000. For example, the plurality of hosts 100 may be directly connected to the state determination device 300 to perform communication. The plurality of hosts 100 may transmit and receive a plurality of messages.

The state determining device 300 may receive and/or capture a plurality of messages transmitted through at least one protocol from the plurality of hosts 100. The state determining device 300 may determine the state of the protocol based on the plurality of messages.

The state determining device 300 may analyze the structure or logic of the protocol through reverse engineering based on a network trace generated in the process of exchanging messages between a plurality of hosts 100.

The state determination device 300 may express the protocol as an automata through a Finite State Machine (FSM). FSM may refer to a model used when designing a structure or architecture for communication. The state determination device 300 may assume that the structure or architecture for communication through the FSM has a finite state, and design and define the content of each state of operation and transition between states.

The state determining device 300 may express the specification of the protocol as an automata through Equations 1 to 3.

M may be a message type, T may be a transition between messages, and F may be a field constituting the message. That is, T may have a transition probability between messages as an element.

That is, the state determining device 300 may set the message type M as a state, and express the FSM of the protocol based on the transition T between each message type M. The state determining device 300 may express the protocol as an automata through FSM based on information obtained in the process of reverse engineering the protocol through Equations 1 to 3.

Referring to FIG. 3, the state determining device 300 may be included in any one of the plurality of hosts 100 (100-7). The state determining device 300 may be included in any one or more of the plurality of hosts 100.

Referring to FIG. 4, the state determining device 300 may perform networking in a kernel-bypass structure. That is, in order to analyze and infer the protocol of the network 1000, work at a user level (user-level) may be required, not a kernel level (kernel-level). Accordingly, the state determining device 300 can perform communication in a synchronous kernel bypass structure based on the PF_RING library. PF_RING may be a socket for packet capture that can quickly forward a packet received from a network device.

The state determining device 300 may perform networking by dividing the message into a control area and a data area through a synchronous kernel bypass structure based on the PF_RING library. In addition, the state determining device 300 is dedicated to performing packet capture by creating a separate thread through a synchronous kernel bypass structure based on the PF_RING library, thereby overcoming the general Linux kernel. It can cause less.

The state determining device 300 may prevent a case in which reverse engineering is not properly performed because a message is lost through a synchronous kernel bypass structure based on the PF_RING library. The general network communication may receive data based on the networking (TCP/IP or UDP) of the kernel through the NIC device driver 480 (Network Interface Card Device Driver). The state determining device 300 may obtain information of the unknown protocol, not TCP/IP, UDP, etc. through a synchronous kernel bypass structure based on the PF_RING library. The state determining device 300 may handle the information of the protocol in the application 410 by passing data to the APP LAYER through a module called PF-RING without passing information from the NIC to the kernel.

The state determining device 300 may perform a message collection function based on TCPDUMP of PF_RING. TCPDUMP can output packets that pass through a network interface that satisfies a given conditional expression.

Referring to FIG. 5, the state determining device 300 may receive a plurality of messages transmitted through at least one protocol mixed in a network trace (510) (510). The state determining device 300 may cluster a plurality of messages for each protocol (530 ). The state determination device 300 may obtain a syntax information, timing information, and semantics information of the protocol by analyzing a plurality of clustered messages (550). The state determining device 300 may determine the state of the protocol based on syntax information, timing information, and semantics information (570).

FIG. 6 is a diagram schematically showing a state determination device illustrated in FIG. 1.

The state determining device 300 may include a transceiver 310, a processor 330, and a memory 350. The state determining device 300 may be connected to and communicate with the network 1000 through the transceiver 310.

The transceiver 310 may be connected to the network 1000 through wireless communication and/or wired communication to communicate with a plurality of hosts 100 and the like. The transceiver 310 may receive a first plurality of messages and a second plurality of messages transmitted through at least one protocol from a plurality of hosts. The transceiver 310 may transmit the first plurality of messages and/or the second plurality of messages to the processor 330.

The transceiver 310 may transmit the determined state of the protocol to a plurality of hosts 100 and/or a server (not shown).

The processor 330 may include one or more of a central processing unit, an application processor, or a communication processor.

The processor 330 may execute an operation or data processing related to control of at least one other component of the state determining device 300. For example, the processor 330 may execute an application and/or software stored in the memory 350.

The processor 330 may process data received by the transceiver 310 and data stored in the memory 350. The processor 330 may process data stored in the memory 350. The processor 330 may execute computer readable code (eg, software) stored in the memory 350 and instructions caused by the processor 330.

The processor 330 may be a data processing device embodied in hardware having circuits having a physical structure for performing desired operations. For example, desired operations may include code or instructions included in a program.

For example, data processing devices implemented in hardware include a microprocessor, a central processing unit, a processor core, a multi-core processor, and a multiprocessor. , ASIC (Application-Specific Integrated Circuit), FPGA (Field Programmable Gate Array).

The processor 330 may acquire syntax information, semantics information, and timing information for at least one protocol based on the plurality of first messages.

The processor 330 may cluster the first plurality of messages for each protocol used for transmission of each of the first plurality of messages.

The processor 330 may acquire syntax information, semantic information, and timing information for a protocol corresponding to the clustered first plurality of messages using the clustered first plurality of messages.

The processor 330 may generate syntax information using the entire field for the first clustered messages and the static field for the first clustered messages. For example, the processor 330 may extract a static field from the clustered first plurality of messages. The processor 330 may extract a keyword repeated in a constant length from the static field. The processor 330 may calculate the length of data for the first plurality of messages clustered using the length of the keyword and the length of the entire field. The processor 330 may generate syntax information using the length of the data, the length of the entire field, and the length of the keyword.

The processor 330 may generate timing information using the clustered first plurality of messages and the static field. For example, the processor 330 may generate timing information based on the order of keywords of each of the first clustered messages corresponding to the order of receiving the first clustered messages.

The processor 330 may generate semantic information based on syntax information and timing information. For example, the processor 330 may select at least one first data message from among the first plurality of messages using syntax information. The processor 330 may generate semantic information using the first data message and timing information.

The processor 330 may determine the state of at least one protocol by using syntax information, semantic information, and timing information, and the length of the message received to date of the second plurality of messages.

The processor 330 may select at least one second data message from the second plurality of messages using timing information and semantic information. The processor 330 may generate a buffer having a length equal to the length of the entire field. The processor 330 may determine the state of the protocol corresponding to the at least one second data message according to whether the length of the buffer is equal to the length of the at least one second data message.

For example, when the length of the buffer is equal to the length of the at least one second data message and the received message to the present, the processor 330 transmits the state of the protocol corresponding to the at least one second data message as completed. Can decide. The processor 330 may determine that the state of the protocol corresponding to the at least one second data message is being transmitted when the length of the buffer is not the same as the length of the at least one data message received to date.

The processor 330 may transmit the determined state of the protocol to the transceiver 310.

The processor 330 may perform a fuzz testing on a keyword to determine an error in a transmission process for a plurality of first messages.

The memory 350 may include volatile and/or nonvolatile memory. The memory 350 may store instructions and/or data related to at least one other component of the state determining device 300.

The memory 350 may store software and/or programs. For example, the memory 350 may store applications and software for determining the state of the protocol.

7 to 9 are diagrams for explaining clustering performed by the state determination apparatus on a plurality of messages.

The state determination device 300 may use a density-based spatial clustering of applications with noise (DBSCAN) as a clustering algorithm for distinguishing multiple protocols for a plurality of messages. DBSCAN is a representative algorithm of unsupervised learning, and it is possible to perform clustering by analyzing data efficiently without specifying the number of clusters. The clustering result of DBSCAN may be characterized in that the same result is consistent even if it is repeated several times.

Referring to FIG. 7, it is possible to indicate the direction and purpose of clustering to be achieved through DBSCAN performed by the state determining device 300. The state determining device 300 assumes that the three clusters shown in FIG. 7 are clearly classified into Protocol A, Protocol B, and Protocol C, and a new point P occurs. Then, you can find the closest cluster based on distance and density among the three clusters, or you can create a new cluster based on the minimum number (minPts) and density (eps).

In the network trace, the state determining device 300 may define, as the feature data, the number of transmission of the message, the transmission time, the length of the message, and the transmission order of the message, based on the source and destination addresses. The state determining device 300 may perform feature engineering that primarily performs heuristic processing on feature data selected for a specific reference time as a process for improving the performance of clustering.

Referring to FIG. 8, FIG. 8 shows an example of a result of clustering in a network trace in which two protocols are mixed. Part A 810 and part B 830 of FIG. 8 may refer to data of different protocols. The result shown in FIG. 8 means that the clusters are not clearly distinguished, and that overlapping sections are largely generated.

The state determining device 300 may solve this problem by processing the feature data related to time more precisely. The state determination device 300 may process time-related feature data in duration or intervals in milliseconds. When the state determining device 300 processes feature data related to time, the clustering performance may be improved when clustering is performed.

In general, there are cases in which the kernel does not support millisecond-level networking, and this may have a problem in that data in less than a second is all described as 0. However, since the state determining device 300 performs networking in a kernel bypass structure, it can perform millisecond-level networking.

The state determining device 300 may implement Principal Component Analysis (PCA) by using an auto-encoder based on a deep neural network. Principal component analysis may refer to a process of selecting components having characteristics that properly express meaning in data. The state determination device 300 may obtain an effect of principal component analysis by using a non-linear linear function such as sigmoid and ReLU, and a mean squared error (MSE) as a loss function.

Referring to FIG. 9, the state determination device 300 may improve processing performance of clustering through DBSCAN by performing processing of feature data related to time and analysis of principal components as an auto-encoder based on a deep neural network. In FIG. 9, it can be seen that the state determining device 300 accurately clusters two different protocols 910 and 950 for a plurality of messages.

10 to 12 are diagrams for describing an operation of the state determining device to acquire syntax information and keywords.

The state determining apparatus 300 may perform a process of classifying various types of messages of each protocol in detail after clustering a plurality of messages. The protocol can exchange various messages for mutual information exchange. The messages exchanged can have different structures and meanings in a defined order. In general, this may be defined by separating the protocol syntax information, timing information, and semantics information.

Syntax in the protocol may mean the format and size of each field and data of the message. Semantics means the meaning of a message, and timing may include information such as when and in what order certain messages are transmitted among several messages. Syntax information, timing information, and semantics information may be required to determine the state of the protocol.

The state determining device 300 may extract static fields (eg, [SYN] 1010, [SYN, ACK] 1030, and [ACK] 1050) from the message. Referring to FIG. 10, a static value can be found in a flag field of a message exchanged during a process of establishing a session in Transmission Control Protocol (TCP). A field having a static value is called a static field, and a field having a variable value can be referred to as a dynamic field.

The state determining device 300 may extract keywords (eg, “SYN”, “SYN, ACK”, and “ACK”) from the static field. Referring to FIG. 11, it can be seen that there are keywords 1100 repeatedly having a static value in the message. The state determining device 300 may extract keywords repeated with a fixed value.

Referring to FIG. 12, the state determining device 300 may extract a keyword through Algorithm 1. That is, the state determining device 300 may extract a static field from the message and a keyword from the static field.

For example, when the extraction of the static field is completed, the state determination device 300 increases and decreases the value for the static field by one byte (1 byte) and stores it in a list, and then repeatedly includes values in fields of other messages The keyword can be extracted by verifying that it exists. That is, the state determining device 300 may extract keywords from the static field one byte at a time by performing keyword= read_byte(field, length) as a loop. For example, the state determining device 300 may initially extract a keyword based on 3 bytes. That is, when the static field has a static value of “abcdef,” the state determining device 300 first extracts “abc” to check whether the other message field has the same value, and if not, increases the “abcd” by increasing one byte. You can search and extract. The state determining device 300 may repeat this operation as much as the size of a static field to extract keywords that occur repeatedly in a plurality of messages.

The state determining device 300 may calculate the length of the message data (Data_size) through Equation 4, that is, by subtracting the keyword length (Keyword_size) from the total field length (Field_size).

The state determining device 300 is Data_size! = sytax can be used to generate syntax information. The state determination device 300 may generate syntax information using the length of the data, the length of the entire field, and the length of the keyword.

13 is a diagram for explaining a process in which the state determination device generates timing information and semantic information.

The state determining device 300 may generate timing information that is an order of the corresponding message through the acquired keyword. The state determining device 300 may obtain the order of the corresponding message by calculating the ratio and order of how many times each keyword is repeated in a large amount of message traffic. In addition, the state determining device 300 may repeatedly perform a task of finding a correlation and a dependency with the next keyword that appears later based on one keyword.

13 shows an example of a process in which the state determining device 300 detects association based on keywords. Referring to FIG. 13, it can be seen that TCP generates a message with the keyword “SYN+ACK” in the sequence after the message with the keyword “SYN”. Thereafter, a message of the keyword “ACK” may appear. The state determining device 300 can obtain the exchange of such message order by verifying by crossing the IP addresses of the two hosts. The state determining device 300 may generate timing information of the protocol through this.

The state determining device 300 may analyze the semantics of the message using the protocol timing information and syntax information. In other words, there are protocols that simply send data messages, such as UDP, but there are protocols that secure sessions and send data limitedly. Accordingly, the state determining device 300 verifies the relevance and semantics of the keyword based on the timing information.

The state determining device 300 may select a data message from the entire network trace. The state determining device 300 may select a data message through the size of the message included in the syntax information or keyword information.

Thereafter, the state determining device 300 may perform a process of checking a message occurring before/after sending a data message from timing information. The state determining device 300 may find association between messages through this process.

In addition, the state determining device 300 may arithmically calculate the ratio of how many times each message type is performed and repeated in the entire communication record. The state determining device 300 may infer what the message means by calculating the ratio of how many times each message type is executed and repeated. In addition, the state determining device 300 can clearly distinguish the data message from other messages through this, and through this, the semantics information can be generated.

14 is a diagram for description of fuzz testing performed by a state determination device.

The state determining device 300 may perform verification and reinforcement of the size of the entire field of the message, obtained in the process of Algorithm 1 through fuzzing, fuzz testing.

For example, referring to FIG. 14, the state determining device 300 adds fuzz data repeating the act of adding “A” and “a” after the keyword, and then reassembles the message and communicates. In the process of, errors can be verified.

The state determining apparatus 300 may obtain an exact offset size of a field for each message through fuzz testing. The reason for repeating “A” and “a” alternately may be to easily find the number of strings when an error occurs. In performing the fuzz testing, the state determining device 300 may perform fuzz testing without a keyword in the case where there is no keyword such as msg4 or a keyword is not detected.

15 shows an example of an algorithm used by the state determining device to determine the state of the protocol.

The state determining device 300 may determine whether or not a message is being received during communication in a corresponding protocol through Algorithm 2 and whether it is being received.

The state determination device 300 sums all the lengths of the fields obtained for the data message and generates a buffer having the same length as the number. The status of the protocol can be determined.

That is, assuming that TCP is transmitted as an example, in the order of SYN message -> SYN+ACK message -> ACK message -> data message, the state determining device 300 can know the reception order of the message through timing information. , It can be seen whether the message to be received is the SYN message, the SYN+ACK message, the ACK message, or the data message through the semantic information. Accordingly, the state determining device 300 may select a data message from a plurality of newly received messages using timing information and semantic information.

Also, the state determining device 300 may generate a buffer having a length equal to the length of all fields included in the syntax information. When the length of the buffer and the length of the newly received message are the same (ie, the newly received message is received in bytes by the length of the buffer, the newly received message is equal to the length of the buffer) It can be determined that the reception of the protocol is complete.

16 is a diagram schematically showing a system according to another embodiment with a focus on transmission and reception of messages and ACKs.

The system 10 may determine the state of the protocol without modifying the protocol itself, even in protocols that do not support error correction or congestion control.

After transmitting the message, the plurality of hosts 100 may wait until an ACK message is received from the state determining device 300. Thereafter, the state determination device 300 may check the progress of the message reception.

When the message reception is completed, the state determining device 300 may inform the plurality of hosts 100 that the reception is completed through an ACK message. The system 10 does not normally reach a message transmitted by the plurality of hosts 100 within the time limit for the state determination device 300, or time-out of the plurality of hosts 100 itself When this occurs, retransmission of the message can be performed.

The protocol state determination operation performed by the state determination device 300 may be applied to a non-reliability protocol such as UDP, through which various application processes occurring in the network may be additionally applied.

17 to 24 are diagrams for explaining the performance evaluation results of the state determination device.

Referring to FIG. 17, in order to consider various results, the performance evaluation of the state determining device 300 may be a test object of the TCP-based FTP protocol, the UDP protocol, and the QUIC protocol developed by Google. The network trace used in the experiment may be a situation in which communication through three protocols is simultaneously performed and mixed.

FTP used to communicate by sending multiple files while using various commands, and UDP may have performed by sending 5,000 random strings (“textdata goes here”) irregularly. And QUIC may have been performing communication that continuously performs video streaming through YouTube.

18 and 19 show an example of a performance evaluation result screen performed for the FTP protocol. FIG. 18 is a screen displayed through a Wireshark program for Traffic Trace of the FTP protocol, and FIG. 19 can show the operation result of the state determining device 300.

Wireshark, an open-source program, may be a representative packet analysis program used for checking communication records through various protocols or for education. Since this analysis performs structural analysis in the assumption that the specification of the protocol is known, accurate results can be ensured. However, the state determination device 300 may perform this analysis through reverse engineering without knowing the specification. Therefore, the performance evaluation of the state determination device 300 can compare the results with Wireshark for the published protocol and consider the results.

20 may represent some of the results of performance evaluation on FTP. Through the results of FIG. 20, it can be seen that the state determining device 300 accurately identifies keywords in the message through reverse engineering and obtains the size of the message field.

21 shows an example of a performance evaluation result performed on the UDP protocol. The automata illustrated in FIG. 21 may mean that UDP has only one state. Such a result may be based on the timing and semantics information acquired by the state determination device 300 through reverse engineering. In addition, in FIG. 21, it can be confirmed that the state determination device 300 extracts only the data string (“text data goes here”) from the structure of the field accurately.

22 may show some of the results of performance evaluation on UDP. It can be seen from FIG. 22 that the state determining device 300 accurately obtains data and size in the message.

23 shows an example of a performance evaluation result performed on the QUIC protocol. The automata shown in FIG. 23 may mean that there is a process (Zero-RTT) in which the QUIC establishes a session once, and thereafter, data is unilaterally transmitted like UDP. Such a result may similarly be obtained based on timing information and semantic information acquired by the state determination device 300 through reverse engineering.

FIG. 24 may be a diagram illustrating that video streaming performed through QUIC is exactly data separated in a field structure. The state determining device 300 may extract only a portion of data that is being encrypted and communicated accurately through syntax information. QUIC provided a FEC that recovers a corrupted bit through a correction bit when a packet is tampered with or corrupted during transmission, showing limitations in detecting it, but it has been confirmed that the function is excluded from the standard.

17 to 24, as a result of performing performance evaluation through a transport layer protocol such as UDP and QUIC, the state determining device 300 considerably increases syntax information, semantic information, and timing information of the message. It can be seen that it can be extracted with accuracy.

The state determining device 300 may infer information and state about the protocol by performing reverse engineering of all protocols of the transport layer based on a network trace, including protocols whose structure or logic is not disclosed.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the medium may be specially designed and constructed for the embodiments or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, and magnetic media such as floptical disks. -Hardware devices specifically configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language code that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and/or data may be interpreted by a processing device or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or may be permanently or temporarily embodied in the transmitted signal wave. The software may be distributed on networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

As described above, although the embodiments have been described by the limited drawings, those skilled in the art can apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order than the described method, and/or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, even if replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (18)

Receiving the first plurality of messages and the second plurality of messages transmitted through at least one protocol from a plurality of hosts;
Obtaining syntax information, semantics information, and timing information for the at least one protocol based on the plurality of first messages; And
Determining the status of the at least one protocol by using the syntax information, the semantic information and the timing information, and the length of the message received to date of the second plurality of messages.
Protocol status determination method comprising a.
According to claim 1,
The obtaining step,
Clustering the first plurality of messages for each protocol used for transmission of each of the first plurality of messages; And
Obtaining the syntax information, the semantic information, and the timing information for a protocol corresponding to the clustered first plurality of messages by using the clustered first plurality of messages.
Protocol status determination method comprising a.
According to claim 2,
The obtaining of the syntax information, the semantic information, and the timing information for a protocol corresponding to the clustered first plurality of messages may include:
Generating the syntax information using an entire field for the clustered first plurality of messages and a static field for the clustered first plurality of messages;
Generating the timing information using the clustered first plurality of messages and the static field; And
Generating the semantic information based on the syntax information and the timing information
Protocol status determination method comprising a.
According to claim 3,
Generating the syntax information,
Extracting the static field from the clustered first plurality of messages;
Extracting a keyword repeated in a certain length from the static field;
Calculating a length of data for the clustered first plurality of messages using the length of the keyword and the length of the entire field; And
Generating the syntax information using the length of the data, the length of the entire field, and the length of the keyword
Protocol status determination method comprising a.
According to claim 4,
Generating the timing information,
Generating the timing information based on an order of keywords of each of the clustered first plurality of messages corresponding to an order of receiving the clustered first plurality of messages.
Protocol status determination method comprising a.
According to claim 4,
The step of generating the semantic information,
Selecting at least one first data message from the first plurality of messages using the syntax information; And
Generating the semantic information using the first data message and the timing information
Protocol status determination method comprising a.
According to claim 4,
The determining step,
Selecting at least one second data message from the second plurality of messages using the timing information and the semantic information;
Creating a buffer having a length equal to the length of the entire field; And
Determining a state of a protocol corresponding to the at least one second data message according to whether the length of the buffer is equal to the length of a message received to date of the at least one second data message;
Protocol status determination method comprising a.
The method of claim 7,
Determining the state of the at least one protocol according to whether the length of the buffer and the length of the received message to the present of the at least one second data message are the same are:
Determining that the state of the protocol corresponding to the at least one second data message is completed when the length of the buffer is equal to the length of the message received to date of the at least one second data message; And
Determining that a state of a protocol corresponding to the at least one second data message is being received when the length of the buffer is not the same as the length of a message received to date of the at least one data message.
Protocol status determination method comprising a.
According to claim 4,
Performing fuzz testing on the keyword to determine an error in the transmission process for the plurality of first messages
Protocol status determination method further comprising a.
A memory for storing instructions for state determination of a protocol; And
Processor for executing the instructions
Including,
When the instructions are executed by the processor, the processor,
Receiving a first plurality of messages and a second plurality of messages transmitted through at least one protocol from a plurality of hosts,
Syntax information, semantics information, and timing information for the at least one protocol are obtained based on the plurality of first messages,
The state of the at least one protocol is determined by using the syntax information, the semantic information, and the timing information, and the length of the message received to date of the second plurality of messages.
Protocol status determination device.
The method of claim 10,
The processor,
Clustering the first plurality of messages for each protocol used for transmission of each of the first plurality of messages,
Acquiring the syntax information, the semantic information, and the timing information for a protocol corresponding to the clustered first plurality of messages by using the clustered first plurality of messages
Protocol status determination device.
The method of claim 11,
The processor,
The syntax information is generated using an entire field for the clustered first plurality of messages and a static field for the clustered first plurality of messages,
The timing information is generated using the clustered first plurality of messages and the static field,
Generating the semantic information based on the syntax information and the timing information
Protocol status determination device.
The method of claim 12,
The processor,
Extracting the static field from the clustered first plurality of messages,
Extract a keyword repeated in a certain length from the static field,
The length of the data for the clustered first plurality of messages is calculated using the length of the keyword and the length of the entire field,
Generating the syntax information using the length of the data, the length of the entire field and the length of the keyword
Protocol status determination device.
The method of claim 13,
The processor,
Generating the timing information based on the order of each keyword of the clustered first plurality of messages corresponding to the order of receiving the clustered first plurality of messages
Protocol status determination device.
The method of claim 13,
The processor,
Selecting at least one first data message from the first plurality of messages using the syntax information,
Generating the semantic information using the first data message and the timing information
Protocol status determination device.
The method of claim 13,
The processor,
At least one second data message is selected from the second plurality of messages by using the timing information and the semantic information,
Create a buffer having a length equal to the length of the entire field,
Determining the state of the protocol corresponding to the at least one second data message according to whether the length of the buffer and the length of the received message of the at least one second data message are the same.
Protocol status determination device.
The method of claim 16,
The processor,
When the length of the buffer and the length of the received message to the present of the at least one second data message are the same, it is determined that reception of the protocol status corresponding to the at least one second data message is completed,
Determining that a state of a protocol corresponding to the at least one second data message is being received when the length of the buffer is not the same as the length of a message received to date of the at least one data message
Protocol status determination device.
The method of claim 13,
The processor,
Fuzz testing is performed on the keyword to determine an error in the transmission process of the plurality of first messages
Protocol status determination device.

Images